Agentifact assessment — independently scored, not sponsored.
WordPress MCP
WordPress REST API via MCP. Posts, pages, media, users, taxonomies.
Viable option — review the tradeoffs
You need to give AI agents (Claude, etc.) structured, permission-aware access to WordPress content and operations without building custom integrations for each AI platform.
Reliable ability discovery and permission enforcement through WordPress' native Abilities API. The local proxy approach adds a translation layer (MCP protocol ↔ HTTP REST), which is robust but introduces a local process dependency. Response times depend on your REST API performance. Tools are exposed as discrete abilities (e.g., 'create post', 'get user info'), not raw API endpoints—this is cleaner for AI but requires upfront ability registration.
You're building an AI agent that needs to read and write WordPress content (posts, pages, media) with fine-grained permission control, not just query data.
Permission enforcement works as expected—API key scope and user role restrictions are enforced server-side. However, you must explicitly register each ability you want to expose; there's no auto-discovery of all REST endpoints. Schema validation happens at the ability level, not the REST layer, so you control what the AI can actually do.
Abilities API adoption still emerging
WordPress MCP relies on the Abilities API, which is relatively new (introduced early 2026). Core WordPress exposes only a handful of abilities ('core/get-site-info', 'core/get-user-info', 'core/get-environment-info'). Most plugins and themes don't yet register abilities, so you'll need to build custom ability wrappers for non-core functionality.
Local proxy setup for non-WordPress.com sites
If you're not on WordPress.com, you must run `mcp-wordpress-remote` as a local Node.js process on the developer's machine. This proxy translates MCP protocol messages to HTTP requests and handles authentication header injection. It's a bridge, not a liability, but it adds a local dependency and requires Node.js.
HTTPS enforcement on production
WooCommerceRestTransport (and likely other transports) enforces HTTPS in production. HTTP is allowed only for local development. If you deploy an MCP server without HTTPS, authentication will fail. Ensure your WordPress site has a valid SSL certificate before connecting production AI clients.
Trust Breakdown
What It Actually Does
Lets AI agents read and manage WordPress content like posts, pages, and media directly through your site's API. Useful for automating publishing workflows or pulling content into other tools.
WordPress REST API via MCP. Posts, pages, media, users, taxonomies.
Fit Assessment
Not ideal for
- ✗plugin conflicts can break REST API responses
Known Failure Modes
- plugin conflicts can break REST API responses